GDPR & AI Compliance

QELVIA SOLUTIONS, S.L. processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), applying the principles of data minimisation, purpose limitation, and privacy by design and by default.

This page details how QELVIA complies with the GDPR when using artificial intelligence models, as well as the safeguards applied, including Zero Data Retention (ZDR).

Qelvia is middleware that operates on the client's own database, hosted on their infrastructure (local server or private cloud). SQL queries are executed locally through a proxy deployed on the client's servers.

The client defines, through explicit configuration, which tables, fields and queries are accessible. Data does not pass through unauthorised third-party servers, and QELVIA does not store conversation history persistently unless the client expressly configures it.

• Data controller: the client, who determines the purposes and means and decides which data is exposed to the system.

• Data processor: QELVIA, which processes data on behalf of the client in accordance with Article 28 of the GDPR and a data processing agreement (DPA).

• Sub-processor: the artificial intelligence provider, in the standard mode with a key managed by QELVIA. In BYOK mode (client's own key), the relationship with the AI provider is directly between the client and that provider.

QELVIA operates exclusively on paid API plans of professional artificial intelligence providers, never on free consumer products. As a selection criterion, QELVIA works with providers that offer contractual data protection guarantees:

• A data processing agreement (DPA) compliant with the GDPR.

• A commitment not to use transmitted data to train their models, under the standard terms of their paid API plans.

• Recognised industry security certifications (typically SOC 2 Type II and ISO/IEC 27001).

The client may request from QELVIA an up-to-date list of supported providers and a copy of the DPAs applicable to the standard mode.

Whenever the selected AI provider allows it, QELVIA applies Zero Data Retention (ZDR) agreements: the text sent and the responses generated are not retained on the provider's systems beyond the time strictly necessary to produce the response, and are excluded from any persistent logging or secondary use.

Where a provider maintains limited temporary retention for security or abuse-prevention purposes, that period is minimal, the data is not used for training, and it is automatically deleted afterwards. Wherever possible, QELVIA prioritises configurations and providers that offer ZDR.

The content transmitted to the AI provider is limited to: (i) the text of the query formulated by the user; and (ii) the result, in JSON format, of the SQL queries previously authorised by the client.

Access credentials, complete database structures and personal data not requested by the user are never transmitted. QELVIA does not integrate advertising or third-party analytics.

Where the AI provider processes data outside the European Economic Area, the transfer is covered by the safeguards provided for in the GDPR (adequacy decisions or the European Commission's standard contractual clauses), set out in the corresponding DPA. Where available, QELVIA prioritises processing in European Union regions.

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction and portability. As the data controller is the client, requests relating to ERP data must be addressed to them. QELVIA, as processor, will provide the reasonable assistance necessary to handle them.

For matters relating to this website or to QELVIA's status as controller of its own contact data, you may write to ouail@qelvia.ai. There is also the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

QELVIA applies appropriate technical and organisational measures: encryption of communications in transit, control and logging of authorised support access, and minimisation of exposed data. QELVIA Business Cloud is listed in the CSA STAR Registry (STAR Level 1) of the Cloud Security Alliance.